fix: reject malformed quoted transaction fields

[wangtaotaotao95]

An amount such as "10"0 in an imported transaction CSV currently becomes 100: the parser closes the quote, then silently appends the remaining characters. The resulting spending report succeeds with a different amount.

Validate the character following a closing quote and reject malformed suffixes with the existing CSV error. Quoted commas, escaped quotes, embedded newlines, empty fields, and supported record endings remain accepted. Text or spaces outside the closing quote are intentionally rejected.

Validation: the new rejection regression fails on the original parser and passes with the fix. The full suite passes (201 tests), along with lint, root/mobile/worker typechecks, server build, and web/iOS/Android bundle exports on Node 24. Focused tests also cover valid quoted-field boundaries. No UI changes; native device runs and Docker container suites were not run locally.

[jerelvelarde]

Useful CSV integrity fix: malformed suffixes after quoted values are rejected instead of silently changing transaction amounts. All 10 focused finance/engine tests pass, including valid quoted commas, escaped quotes, multiline values and line endings. Description records verification and limits. No actionable correctness or security findings. Merge only after current-main CI passes.

[jerelvelarde]

Re-reviewed the current-main update: the PR's fix and its regression tests remain unchanged in scope, and recently merged behavior/tests are retained. No new actionable findings. Approval applies to this updated head; merge after all seven required CI checks pass.